numando | 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5

Analysis

Target

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
Size

10.0MB
MD5

59431e5b73b362bf13f6cbc8f593f465
SHA1

927fb2c5ac6da16214209d28264d850e7228ed7a
SHA256

3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
SHA512

cfd086fa39be7be0f725b3998545bdf3d6ff9a012187cc4505ac7f1f79770cfcf01295f93e6e8984f5aece57d4b4cdeaf1545bedcae2ecb9957ca42feb75b72e

Score

10^/10

Detect Numando Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp	family_numando
behavioral2/memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp	family_numando

Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
trojan backdoor numando

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/1088-131-0x0000000002590000-0x0000000003A19000-memory.dmp	vmprotect
behavioral2/memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp	vmprotect
behavioral2/memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4980	1088	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1088	1820	rundll32.exe	80
PID 1820 wrote to memory of 1088	1820	rundll32.exe	80
PID 1820 wrote to memory of 1088	1820	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 696
    3⤵
    - Program crash
    PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 1088
1⤵
PID:3284

memory/1088-131-0x0000000002590000-0x0000000003A19000-memory.dmp

Filesize
20.5MB

Download
memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp

Filesize
20.5MB

Download
memory/1088-133-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1088-134-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Filesize
4KB

Download
memory/1088-136-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

Filesize
4KB

Download
memory/1088-135-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/1088-137-0x0000000003AE0000-0x0000000003AE1000-memory.dmp

Filesize
4KB

Download
memory/1088-138-0x0000000003AF0000-0x0000000003AF1000-memory.dmp

Filesize
4KB

Download
memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp

Filesize
20.5MB

Download